2019 ICS Cyber Security Conference | USA

Assessing all control systems against the same metrics and expectations will result in companies focusing on the wrong corrective actions. Different industries such as Consumer Manufactured Goods, Pharmaceuticals, and Critical Infrastructure have different thresholds for risk acceptance. When performing assessments for different clients, the need to create a baseline for specific industries was found to be necessary. This presentation will highlight some of the applications of the NIST Cybersecurity Framework by defining unique baselines for different industry verticals, the potential benefits of defining industry-specific goals, and examples of how those would work within real industries and companies.